VirtualTam's bookmarks

1. snksoft/crc - Generic CRC implementation for Go 2025-03-23

   tags: cryptography/hash, programming/go

   [ permalink ]

   • 16, 32, 64 bits
   • Custom parameters: polynomial, XOR, reverse input/output bits
   • Flexible alternative to hash/crc32 and hash/crc64
2. Hockeypuck - An OpenPGP public keyserver 2025-02-06

   tags: cryptography/pgp, programming/go

   [ permalink ]
3. badkeys - Checking cryptographic public keys for known vulnerabilities 2025-01-18

   tags: cryptography/elliptic-curve, cryptography/rsa, leak, programming/python, security, security/password

   [ permalink ]

   • badkeys/badkeys
   • Private Keys in the Fortigate Leak
4. CPython - Sigstore Information 2024-12-30

   tags: cryptography/certificate, cryptography/signature, programming/python, programming/python/pypi

   [ permalink ]

   • Python and Sigstore
   • PyPI now supports digital attestations
5. Sigstore - sign. verify. protect. Making sure your software is what it claims to be. 2024-12-30

   tags: cryptography/certificate-authority, cryptography/public-key-infrastructure, cryptography/signature, linux/container

   [ permalink ]

   • sigstore/cosign - Code signing and transparency for containers and binaries
   • sigstore/fulcio - Sigstore OIDC PKI
   • sigstore/rekor - Software Supply Chain Transparency Log
6. DNS over HTTPS 2024-11-25

   tags: cryptography/encryption, ietf/rfc, internet/browser/chrome, internet/browser/firefox, network/dns, network/http, network/transport-layer-security

   [ permalink ]

   RFCs:

   • RFC 7858 - Specification for DNS over Transport Layer Security (TLS)
   • RFC 8484 - DNS Queries over HTTPS (DoH)

   Resources:

   • Carsten Strotmann - doh.defaultroutes.de DNS-over-TLS/HTTPS Server
   • DNS over HTTPS - Cloudflare 1.1.1.1 Documentation

   Setting up a DNS-over-HTTPS server:

   • DNS over HTTPS - ArchWiki
   • DNS-over-TLS almost working - Træfik Forum
   • Using Google’s dns.google.com with CoreDNS

   Browser configuration:

   • Configure DoH on your browser - Cloudflare Documentation
   • Using custom DNS-over-HTTPS with CoreDNS and Google Chrome
   • Firefox DNS-over-HTTPS - Firefox Help
7. Breaking CityHash64, MurmurHash2/3, wyhash, and more... 2024-11-03

   tags: cryptography/hash, programming/c++

   [ permalink ]

   • Hash-flooding DoS reloaded: attacks and defenses (PDF)
8. SSHFP - Secure SHell FingerPrint DNS Records 2024-10-27

   tags: cryptography/elliptic-curve, network/dns, network/dnssec, network/ssh

   [ permalink ]

   • IANA - DNS SSHFP Resource Record Parameters
   • ssh - How do I generate SSHFP records?
   • Oh SSH-it, What’s My Fingerprint? A Large-Scale Analysis of SSH Host Key Fingerprint Verification Records in the DNS
     • gehaxelt/sshfp-dns-measurement
     • APNIC - Improving SSH’s security with SSHFP DNS records

   RFCs:

   • RFC 4251 - The Secure Shell (SSH) Protocol Architecture
   • RFC 4255 - Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints
9. Building a Kubernetes Home Lab on the Raspberry Pi 2024-05-28

   tags: cryptography/certificate-authority, distributed-system, linux/container, linux/container/kubernetes, network/dns, raspberry-pi, self-hosting

   [ permalink ]

   1. Architecture & Roadmap
   2. Setup Kubernetes Management Node and Private Certificate Authority
   3. Configuring a Multi-Architecture Build Process
   4. Local DNS Services
10. smallstep/certificates - A private certificate authority (X.509 & SSH) & ACME server for secure automated certificate management 2024-05-27

    tags: cryptography/certificate, cryptography/certificate-authority, network/http, network/http-server/traefik, network/reverse-proxy, network/transport-layer-security, programming/go

    [ permalink ]

    • Run a private online TLS certificate authority in a Docker container
    • Configure popular ACME clients to use a private CA with the ACME protocol
    • Run your own private CA & ACME server using step-ca
    • Build a Tiny Certificate Authority For Your Homelab
11. The Copenhagen Book - General guidelines on implementing authentication and authorization in web applications 2024-04-05

    tags: cryptography/hash, memory/cache, network/http, network/http/cookie, programming/go, security/authentication, security/authorization, security/oauth, security/password

    [ permalink ]

    • pilcrowOnPaper/copenhagen
12. Bloom Filters 2024-03-31

    tags: cryptography/hash, data-structure/bloom-filter, memory/cache, programming/javascript, visualization

    [ permalink ]

    • Akamai - Algorithmic Nuggets in Content Delivery
    • Hashing
    • samwho/visualisations
13. The Sunlight Certificate Transparency Log 2024-03-16

    tags: cryptography/certificate, cryptography/certificate-authority, data-structure/tree, data-structure/tree/merkle-tree, letsencrypt, programming/go

    [ permalink ]

    • Introducing Sunlight, a CT implementation built for scalability, ease of operation, and reduced cost
    • Transparent Logs for Skeptical Clients
    • C2SP/C2SP - Community Cryptography Specification Project
    • FiloSottile/sunlight
    • transparency-dev/serverless-log
14. haiti - Hash Type Identifier 2024-03-14

    tags: command-line, cryptography/hash, programming/ruby

    [ permalink ]
15. We build X.509 chains so you don’t have to 2024-01-26

    tags: cryptography/certificate, programming/go, programming/python, programming/rust

    [ permalink ]

    • pyca/cryptography - src/rust/cryptography-x509-verification
    • C2SP/x509-limbo - A suite of testvectors for X.509 certificate path validation and tools for building them
16. Debian Package Repository - Instructions to connect to a third-party repository (with Ansible) 2024-01-06

    tags: configuration-management/ansible, cryptography/pgp, cryptography/pgp/gnupg, linux/debian, linux/ubuntu, packaging

    [ permalink ]

    • apt_key deprecated in Debian/Ubuntu - how to fix in Ansible
    • ansible.builtin.deb822_repository - Add and remove deb822 formatted repositories
    • ansible/ansible#78063 - ansible.builtin.apt_key adds keys to a deprecated location
    • Example usages of the new deb822_repository Ansible module
    • Ubuntu [Spec] APT deb822 sources by default
17. Sequoia-PGP - OpenPGP Implementation in Rust 2023-11-09

    tags: command-line, cryptography/encryption, cryptography/pgp, cryptography/pgp/gnupg, linux/debian, linux/fedora, programming/rust, security

    [ permalink ]

    • Sequoia PGP: A Sapling Matures: Meet sq 1.0
    • Talk about OpenPGP interop testing at the IETF 110
    • sequoia-pgp/sequoia - APIs for dealing with OpenPGP data
    • sequoia-pgp/sequoia-sq - the Sequoia-PGP command line tool
    • RpmSequoia
18. HAProxy - TLS Termination Setup 2023-07-24

    tags: cryptography/encryption, network/http, network/reverse-proxy, network/reverse-proxy/haproxy, network/transport-layer-security, security

    [ permalink ]

    • Traffic Routing - Rewrite Requests
    • Client IP Preservation - X-Forwarded-For
    • HAProxy & HTTP Strict Transport Security (HSTS)
    • Secure Cookies Using HAProxy Enterprise
19. passkeys - Hello passkeys! Goodbye passwords. 2023-06-11

    tags: cryptography/public-key-infrastructure, internet/browser/chrome, internet/browser/firefox, mobile/android, mobile/ios, security/authentication

    [ permalink ]

    Passkeys are a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices. Unlike passwords, passkeys are always strong and phishing-resistant.

    • https://fidoalliance.org/passkeys/
    • Apple Developer - Passkeys Overview
    • Apple Support - About the security of passkeys
    • Google Identity - Passwordless login with passkeys
    • Google Blog - The beginning of the end of the password
    • Google Security Blog - So long passwords, thanks for all the phish
    • Chromium BLog - Introducing passkeys in Chrome
    • Tailscale doesn't want your password
    • Tailscale - Custom OIDC Providers
    • YubiKeys, passkeys and the future of modern authentication
    • A Yubico FAQ about passkeys
    • Why Passkeys Will Be Simpler and More Secure Than Passwords
    • Passkeys: A shattered dream
20. WebAuthn - An API for accessing Public Key Credentials 2023-06-11

    tags: cryptography/public-key-infrastructure, internet/browser, security/authentication

    [ permalink ]

    The Web Authentication API (also known as WebAuthn) is a specification written by the W3C and FIDO, with the participation of Google, Mozilla, Microsoft, Yubico, and others. The API allows servers to register and authenticate users using public key cryptography instead of a password.

    • Guide to Web Authentication
    • Asynchronous Remote Key Generation: An Analysis of Yubico’s Proposal for W3C WebAuthn [PDF]
    • Issue 664630: Web Authentication API for Chrome
    • Bugzilla - [meta] Update WebAuthn JS API to the L1-REC spec
    • keepassxc#1870 - Feature Request: Integration with the Web Authentication API